Advanced packet forwarding systems can support multiple virtual routing and forwarding (VRF) subsystems. In Internet Protocol (IP) based computer networks, VRF technology can provide an ability to configure different virtual routers on the same hardware. For example, multiple instances of the virtual routers can coexist within a same network device. In some implementations, each VRF subsystem can represent a customer, an organization, or a department in an organization. Thus, VRF technology may be used to isolate different customers, departments or organizations from one another using the same physical infrastructure.
Generally, a packet entering a network device may be processed by multiple packet processors inside a VRF subsystem. Each packet processor can make a decision about the packet and forward its decision to a priority arbiter. The priority arbiter considers the decisions from all the participating packet processors for each VRF subsystem and makes a decision on the packet based on a pre-configured priority for each VRF subsystem. For example, the decision can be to drop the packet or to forward the packet. Generally, different VRF subsystems may support different functionalities. For example, a first VRF subsystem may only support layer 3 (L3) functionality, a second VRF subsystem may only support layer 2 (L2) functionality and a third VRF subsystem may only support security related functionality. However, the priority arbiter generates a final decision based on the pre-configured priorities associated with each VRF subsystem even though some of the decisions may not be relevant. Thus, network devices employing single priority arbiters may result in complex and hard to maintain deployment architecture when supporting multiple VRF subsystems.